Identity is not authority: the missing check before AI agents act (delegus.ai)

A new essay highlights a critical gap in how AI agents are monitored and controlled, specifically addressing the distinction between identity and authority. While AI agents excel in executing tasks and operations autonomously, the author points out that current security practices do not adequately address what these agents are allowed to do in real-time. Many existing systems focus heavily on identity verification but fail to impose necessary limits on the actions agents can take, leading to potential costly errors. The emphasis is on ensuring that authority—what an agent is permitted to do—must be actively verified each time before an action is completed. This issue is significant for the AI/ML community as it reveals the need for new frameworks that set boundaries for AI actions. The author introduces the Delegus specification, which establishes a model where each action by an AI agent requires fresh permission from the organization, signed and validated at the moment of activity. This approach includes mechanisms for revocation and creates a fixed record of decisions made, ensuring accountability. The challenges posed by increasingly capable AI agents necessitate stronger governance frameworks to protect organizations from unauthorized actions and costly mistakes, while still allowing for expanded use of AI technology.